draft(worker): add fail-closed Qwen H200 client scaffolding

[thegeorgepu]

Summary

• Add internal, draft client scaffolding for an OpenAI-compatible qwen-h200 lane pinned to Qwen/Qwen3.8-27B.
• Add closed parsing and validation for qualification, endpoint identity, WorkOrder/Run/Attempt attribution, bounded transport, invocation accounting, reservation/reconciliation bindings, and a persistent circuit breaker.
• Bind the Worker launcher selection to the validated envelope and bind digest-form Governor leases to the immutable WorkOrder ID.
• Keep the production lane inert: vinci-qwen-provider.ts throws qwen_dispatcher_unavailable before readiness, provider registration, or provider transport.
• Add synthetic, offline-only negative and adversarial tests. The real-daemon composition test proves the hard refusal, correct WorkOrder lease, one failed terminal/release, zero cost, and no non-loopback provider or fallback request.

Current readiness status

This is not a successful Qwen inference implementation and is not an activation candidate.

• No successful production Qwen request has been made or demonstrated.
• No live endpoint qualification, Governor admission, burn-in, soak, or concurrency promotion has occurred.
• Every endpoint, credential, readiness, canary, reservation, reconciliation, and streaming success exercised by the tests is synthetic and offline.
• Test-only reservation callbacks and fake Governor services are not production authority.
• Qwen output remains non-authoritative and cannot satisfy independent verification by itself.

Required upstream dependency

A separately deployed, separate-UID VGC dispatcher contract remains required. It must be the sole Qwen credential consumer, mint authenticated point-of-use reservations, preserve endpoint-global occupancy, and produce authoritative invocation reconciliation. Its route schemas, identity binding, IPC/peer-credential trust, expiry/reaping, failure semantics, and ownership must be ratified and independently reviewed in vinci-gpu-control.

Removing qwen_dispatcher_unavailable requires a separate reviewed change after that dependency exists. Removing the hard stop alone is forbidden and insufficient. VGC admission, qualification, burn-in, deployment, and activation remain independent gates; this draft does not satisfy or bypass them.

Runtime-launch and ownership boundary

This PR does change Worker/client launch plumbing in vinci/worker/run.mjs and vinci/bin/vinci: it selects the Qwen extension from the validated envelope, passes the pinned model, binds exact Worker identities, and supplies a file-backed secret through descriptor 3 without exposing the secret path to the child environment or argv.

The descriptor-3 direct Worker credential path is dormant scaffolding and does not satisfy the final separate-UID credential-owner design. Activation must replace or remove direct Worker credential consumption, or obtain a separately ratified design that explicitly authorizes it; the dispatcher stop cannot be removed merely because this plumbing exists.

Those changes do not download weights, start or configure the inference server, place GPUs, deploy an endpoint, or operate live model infrastructure. Ayush retains ownership of model weights, server runtime and flags, GPU placement, endpoint operation, and the live served revision/runtime tuple.

Safety boundary

• No credential material, secrets, or live credentials are included. Credential-handling plumbing is included, but no IAM change, deployment, GPU operation, model download, merge, release, or live provider call is included.
• There is no automatic fallback and no successful provider result in the actual-daemon composition test.
• The hard dispatcher stop remains the production boundary.
• PR fix(worker): bind governed evidence and terminal to WorkOrder #53 owns evidence-identity behavior. The Qwen refusal test intentionally makes no assertion about the number of evidence ledger posts, so it remains compatible with fix(worker): bind governed evidence and terminal to WorkOrder #53's broader validated identity handling.
• Known follow-up gaps include preserving the actual extension-startup failure as the terminal reason rather than the generic no_commit outcome. These gaps are not presented as readiness.

Verification

• npm run check
• node vinci/test/worker-qwen-provider.mjs
• node vinci/test/worker-lease-loop.mjs
• node vinci/test/worker-qwen-refusal-composition.mjs
• git diff --check

Publication identities:

• Base: 4c22def339c77fdd1be5843f3229cac793506d78
• Head: 490eee9ee34bdf58534abf19cdff8a9dc7e80867
• Tree: 571914267febcac855c4afcc2178fef05ce8a83f

Local reviewed candidate when this draft was prepared:

• Head: 490eee9ee34bdf58534abf19cdff8a9dc7e80867
• Tree: 571914267febcac855c4afcc2178fef05ce8a83f